Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ssl certs to cloudsql instance #1049

Merged
merged 7 commits into from
Dec 12, 2022
+31 −10
Merged

Add ssl certs to cloudsql instance #1049

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
b7fa0b3
add ssl certs to cloudsql instance
prabhaarya Dec 12, 2022
2aa7e0d
Merge pull request #1 from prabhaarya/feature/ssl_certs
prabhaarya Dec 12, 2022
6b7bb6f
rename variable
prabhaarya Dec 12, 2022
79a340f
Merge pull request #2 from prabhaarya/feature/ssl_certs
prabhaarya Dec 12, 2022
1f3c8f6
Merge branch 'master' into master
ludoo Dec 12, 2022
4ec82a9
fix typo
prabhaarya Dec 12, 2022
27751b8
Merge pull request #3 from prabhaarya/feature/ssl_certs
prabhaarya Dec 12, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 12 additions & 10 deletions modules/cloudsql-instance/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,9 +149,9 @@ module "db" {
| [database_version](variables.tf#L49) | Database type and version to create. | <code>string</code> | ✓ | |
| [name](variables.tf#L102) | Name of primary instance. | <code>string</code> | ✓ | |
| [network](variables.tf#L107) | VPC self link where the instances will be deployed. Private Service Networking must be enabled and configured in this VPC. | <code>string</code> | ✓ | |
| [project_id](variables.tf#L122) | The ID of the project where this instances will be created. | <code>string</code> | ✓ | |
| [region](variables.tf#L127) | Region of the primary instance. | <code>string</code> | ✓ | |
| [tier](variables.tf#L147) | The machine type to use for the instances. | <code>string</code> | ✓ | |
| [project_id](variables.tf#L128) | The ID of the project where this instances will be created. | <code>string</code> | ✓ | |
| [region](variables.tf#L133) | Region of the primary instance. | <code>string</code> | ✓ | |
| [tier](variables.tf#L153) | The machine type to use for the instances. | <code>string</code> | ✓ | |
| [authorized_networks](variables.tf#L17) | Map of NAME=>CIDR_RANGE to allow to connect to the database(s). | <code>map&#40;string&#41;</code> | | <code>null</code> |
| [availability_type](variables.tf#L23) | Availability type for the primary replica. Either `ZONAL` or `REGIONAL`. | <code>string</code> | | <code>&#34;ZONAL&#34;</code> |
| [backup_configuration](variables.tf#L29) | Backup settings for primary instance. Will be automatically enabled if using MySQL with one or more replicas. | <code title="object&#40;&#123;&#10; enabled &#61; bool&#10; binary_log_enabled &#61; bool&#10; start_time &#61; string&#10; location &#61; string&#10; log_retention_days &#61; number&#10; retention_count &#61; number&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code title="&#123;&#10; enabled &#61; false&#10; binary_log_enabled &#61; false&#10; start_time &#61; &#34;23:00&#34;&#10; location &#61; null&#10; log_retention_days &#61; 7&#10; retention_count &#61; 7&#10;&#125;">&#123;&#8230;&#125;</code> |
Expand All @@ -163,10 +163,11 @@ module "db" {
| [flags](variables.tf#L84) | Map FLAG_NAME=>VALUE for database-specific tuning. | <code>map&#40;string&#41;</code> | | <code>null</code> |
| [ipv4_enabled](variables.tf#L90) | Add a public IP address to database instance. | <code>bool</code> | | <code>false</code> |
| [labels](variables.tf#L96) | Labels to be attached to all instances. | <code>map&#40;string&#41;</code> | | <code>null</code> |
| [prefix](variables.tf#L112) | Optional prefix used to generate instance names. | <code>string</code> | | <code>null</code> |
| [replicas](variables.tf#L132) | Map of NAME=> {REGION, KMS_KEY} for additional read replicas. Set to null to disable replica creation. | <code title="map&#40;object&#40;&#123;&#10; region &#61; string&#10; encryption_key_name &#61; string&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [root_password](variables.tf#L141) | Root password of the Cloud SQL instance. Required for MS SQL Server. | <code>string</code> | | <code>null</code> |
| [users](variables.tf#L152) | Map of users to create in the primary instance (and replicated to other replicas) in the format USER=>PASSWORD. For MySQL, anything afterr the first `@` (if persent) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. | <code>map&#40;string&#41;</code> | | <code>null</code> |
| [postgres_client_certificates](variables.tf#L112) | Map of cert keys connect to the application(s) using public IP. | <code>list&#40;string&#41;</code> | | <code>null</code> |
| [prefix](variables.tf#L118) | Optional prefix used to generate instance names. | <code>string</code> | | <code>null</code> |
| [replicas](variables.tf#L138) | Map of NAME=> {REGION, KMS_KEY} for additional read replicas. Set to null to disable replica creation. | <code title="map&#40;object&#40;&#123;&#10; region &#61; string&#10; encryption_key_name &#61; string&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [root_password](variables.tf#L147) | Root password of the Cloud SQL instance. Required for MS SQL Server. | <code>string</code> | | <code>null</code> |
| [users](variables.tf#L158) | Map of users to create in the primary instance (and replicated to other replicas) in the format USER=>PASSWORD. For MySQL, anything afterr the first `@` (if persent) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. | <code>map&#40;string&#41;</code> | | <code>null</code> |

## Outputs

Expand All @@ -181,8 +182,9 @@ module "db" {
| [ips](outputs.tf#L61) | IP addresses of all instances. | |
| [name](outputs.tf#L69) | Name of the primary instance. | |
| [names](outputs.tf#L74) | Names of all instances. | |
| [self_link](outputs.tf#L82) | Self link of the primary instance. | |
| [self_links](outputs.tf#L87) | Self links of all instances. | |
| [user_passwords](outputs.tf#L95) | Map of containing the password of all users created through terraform. | ✓ |
| [postgres_client_certificates](outputs.tf#L82) | The CA Certificate used to connect to the SQL Instance via SSL. | ✓ |
| [self_link](outputs.tf#L88) | Self link of the primary instance. | |
| [self_links](outputs.tf#L93) | Self links of all instances. | |
| [user_passwords](outputs.tf#L101) | Map of containing the password of all users created through terraform. | ✓ |

<!-- END TFDOC -->
7 changes: 7 additions & 0 deletions modules/cloudsql-instance/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,3 +175,10 @@ resource "google_sql_user" "users" {
host = each.value.host
password = each.value.password
}

resource "google_sql_ssl_cert" "postgres_client_certificates" {
for_each = var.postgres_client_certificates != null ? toset(var.postgres_client_certificates) : toset([])
provider = google-beta
instance = google_sql_database_instance.primary.name
common_name = each.key
}
4 changes: 4 additions & 0 deletions modules/cloudsql-instance/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,10 @@ output "names" {
}
}

output "postgres_client_certificates" {
description = "The CA Certificate used to connect to the SQL Instance via SSL."
}

output "self_link" {
description = "Self link of the primary instance."
value = google_sql_database_instance.primary.self_link
Expand Down
6 changes: 6 additions & 0 deletions modules/cloudsql-instance/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,12 @@ variable "network" {
type = string
}

variable "postgres_client_certificates" {
description = "Map of cert keys connect to the application(s) using public IP."
type = list(string)
default = null
}

variable "prefix" {
description = "Optional prefix used to generate instance names."
type = string
Expand Down